credential: handle `credential.<partial-URL>.<key>` again